Privacy Policy

1. Who we are

Inlay ("we", "us", "our") operates the Inlay platform, accessible at useinlay.com. We provide native ad monetisation services to website publishers. This policy explains what personal data we collect, why, and how you can control it.

2. Data we collect

Account data. When you create an account we collect your name, email address, and (for password accounts) a bcrypt-hashed password. OAuth sign-ins (Google, GitHub) provide your name, email, and profile picture via the provider.

Billing data. Subscription and payment details are handled entirely by Stripe. We store your Stripe customer ID and subscription status but never see full card numbers.

Publisher payout data. For Stripe Connect payouts we store your connected account ID and payout history. Bank account details are held exclusively by Stripe.

Analytics data. We collect aggregated impression and click counts per ad placement. We do not collect or store the personal data of your site's end visitors.

Technical data. Standard server logs (IP address, user agent, request path, timestamp) retained for up to 30 days for security and debugging.

3. How we use your data

• To provide, maintain and improve the Inlay platform
• To process subscription billing and publisher payouts
• To send transactional emails (account events, payout notifications, payment alerts)
• To enforce plan limits and prevent abuse
• To comply with legal obligations

We do not sell personal data to third parties. We do not use your data for behavioural advertising.

4. Third-party services

We use the following sub-processors:

• Stripe — payment processing and publisher payouts (USA)
• Vercel — hosting and serverless compute (USA/EU)
• Anthropic — AI template generation via Claude API (USA)
• Resend — transactional email delivery (USA)
• Sentry — error monitoring (USA/EU)
• Upstash — distributed rate limiting (USA/EU, if configured)

5. Data retention

Account data is retained for the lifetime of your account and deleted within 30 days of account deletion. Aggregated analytics (impression and revenue totals) may be retained for up to 7 years for financial record-keeping. Server logs are deleted after 30 days.

6. Your rights

Under GDPR and equivalent laws you have the right to access, correct, export, or delete the personal data we hold about you. To exercise any of these rights, email privacy@useinlay.com. We will respond within 30 days.

You may delete your account at any time from Settings → Delete account. This permanently removes all your data from our systems.

7. Cookies

We use a single session cookie to keep you logged in. We do not use tracking or advertising cookies. See our Cookie Policy for details.

8. Changes to this policy

We may update this policy from time to time. Material changes will be emailed to registered users at least 14 days in advance. Continued use of the platform after the effective date constitutes acceptance.

9. Contact

For privacy questions or data requests, contact us at privacy@useinlay.com.